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Abstract — A fundamental requirement for the integration of 
unmanned aircraft into civil airspace is the capability of aircraft 
to remain well clear of each other and avoid collisions. This 
requirement has led to a broad recognition of the need for 
an unambiguous, formal definition of well clear . It is further 
recognized that any such definition must be interoperable with 
existing airborne collision avoidance systems (ACAS). A particu- 
lar class of well-clear definitions uses logic checks of independent 
distance thresholds as well as independent time thresholds in 
the vertical and horizontal dimensions to determine if a well- 
clear violation is predicted to occur within a given time interval. 
Existing ACAS systems also use independent distance thresholds, 
however a common time threshold is used for the vertical and 
horizontal logic checks. The main contribution of this paper is 
the characterization of the effects of the decoupled vertical time 
threshold on a well-clear definition in terms of (1) time to well- 
clear violation, and (2) interoperability with existing ACAS. The 
paper provides governing equations for both metrics and includes 
simulation results to illustrate the relationships. In this paper, 
interoperability implies that the time of well-clear violation is 
strictly less than the time a resolution advisory is issued by ACAS. 
The encounter geometries under consideration in this paper are 
initially well clear and consist of constant- velocity trajectories 
resulting in near-mid-air collisions. 

Keywords — sense and avoid; self separation; well clear; col- 
lision avoidance; unmanned aircraft systems; safety; interoper- 
ability 

I. Introduction 

A widely accepted requirement for the safe integration of 
unmanned aircraft into civil airspace is the need for adequate 
detect-and- avoid (D&A) or sense-and-avoid (SAA) 1 systems 
[1,3-5]. The FAA- sponsored SAA Workshop for unmanned 
aircraft systems (UAS) defines sense and avoid as “the capa- 
bility to remain well clear from and avoid collisions with other 
airborne traffic” [6]. In the context of remotely-piloted UAS, 
both EUROCONTROL [7] and ICAO [2] have also made 
reference to the well-clear and collision- avoidance functional 
aspects of SAA. This terminology is also paralleled in the 
existing regulatory framework governing manned aircraft. 

Under visual flight rules (VFR) for manned aircraft op- 
erations, onboard pilots are required to remain well clear 
of other aircraft when complying with the particular rules 

1 As in [1,2], this paper uses the terms detect and avoid and sense and avoid 

interchangeably. 


addressing right-of-way [8,9]. Furthermore, the pilot always 
has the responsibility for avoiding collisions by not “operating 
an aircraft so close to another aircraft as to create a collision 
hazard” [10,11]. In this context, the ability to remain well clear 
and avoid collisions depends, in part, upon the perception and 
judgement of a human pilot. 

In the absence of an onboard pilot to make a determination 
of being well clear, the need for an unambiguous, quantitative 
definition has been identified [12-18]. Additionally, the need 
for compatibility/interoperability between existing airborne 
collision avoidance systems (ACAS) and future UAS SAA 
functionality is a well-established problem concerning the 
integration of UAS into civil airspace [1,14-16,19-22]. In 
general, maneuvers to maintain well clear are made much 
earlier than collision avoidance maneuvers [14-16,19]. Hence, 
a well clear determination should be large enough to avoid 
collision advisories, yet not so large as to cause undue concern 
for traffic aircraft [20]. 

The particular ACAS considered in this paper is Traffic alert 
and Collision Avoidance System (TCAS) II [23]. In the US, 
TCAS II is mandated for use in aircraft having greater than 
30 seats or maximum takeoff weight (MTOW) greater than 
33,000 lbs. In the EU, ACAS II 2 is mandated for use by aircraft 
authorized to carry more than 19 passengers or MTOW greater 
than 5700 kg [24]. The high-level logic of TCAS II is based 
on checks of time and distance variables against predefined 
thresholds in the horizontal and vertical dimensions, which 
vary as a function of the sensitivity level (SL) at which the 
aircraft is operating, where the SL is determined by the altitude 
of the aircraft. The time threshold, Tau, and the respective 
relative horizontal and vertical distance thresholds, DMOD and 
ZTHR, jointly characterize a Collision Avoidance Threshold 
(CAT), whereby simultaneous violations in the vertical and 
horizontal dimensions triggers a TCAS II traffic advisory (TA) 
or resolution advisory (RA) [25]. Different sets of threshold 
values are used to determine which of these two types of 
advisories is issued. This paper restricts attention to the more 
serious case of TCAS II RAs, which are intended to provide 
guidance to pilots to maintain or increase vertical separation 
from other aircraft. A listing of the time and distance thresh- 


2 At the time of this paper, ACAS II is realized as TCAS II. 



olds used by TCAS II for RAs at each SL is given in Table I 
[23]. As shown in Table I, the horizontal and vertical time 
variables are compared to a single time threshold, Tau. It 
should be noted that there are two types of TCAS II RA: 
preventive and corrective , where the particular type of RA to 
be issued is determined by further logic checks. Preventive 
RAs do not require a change in the aircraft’s vertical speed, 
and corrective RAs do require such a change [25]. This paper 
considers interoperability with respect to both types of RA, 
although the corrective RA is of particular practical concern 
[ 20 ]. 

The necessity for interoperability with TCAS II has led to 
proposals that a formal definition for well clear be explic- 
itly based on time and distance thresholds [15,17,18]. Such 
thresholds then characterize a well-clear boundary (WCB). 
That is, crossing the WCB signifies a loss of well clear, i.e., 
a well-clear violation (WCV) has occurred. The mathematical 
definitions for such a class of WCB models have been sum- 
marized in [18]. An important feature of these WCB models 
is the explicit decoupling of the time threshold into horizontal 
and vertical components, TTHR and TCOA, respectively. 
This decoupling represents a high-level distinction from the 
TCAS II logic. A primary motivation for this paper is to 
present the resulting effects of this decoupling in terms of 
time to WCV and TCAS II interoperability. 

The models in [18] also allow for predictions of future 
WCVs, assuming constant velocities. Furthermore, a high- 
level specification of the TCAS II RA logic is given in [26], 
where it is possible to predict the time at which a TCAS II 
RA will be issued. A key property maintained by a subset of 
the WCB models in [18] is that there exists some choice of 
time and distance thresholds such that the resulting WCB is 
guaranteed to lie outside of the CAT defined by TCAS II for 
any sensitivity level. For the analysis in this paper, TCAS II 
interoperability implies that a WCV occurs prior to a TCAS 
II RA. However, it should be noted that the selection of 
thresholds which guarantee such TCAS II interoperability may 
not always be practical from an operational standpoint. Thus, 
there are perhaps situations where it is operationally acceptable 
for a TCAS II RA to be issued prior to a WCV. Furthermore, 
there may also exist practical mitigating factors (e.g., air traffic 
control) which could act to prevent such scenarios. This paper 
does not address these last two considerations, thus the scope 
of the paper is limited to mathematical interoperability of 


TABLE I 

TCAS II Sensitivity Level (SL) versus Resolution Advisory 
(RA) Thresholds 


Own Altitude (ft) 

SL 

Tau (s) 

DMOD (nmi) 

ZTHR (ft) 

< 1000 (AGL) 

2 

N/A 

N/A 

N/A 

1000 - 2350 (AGL) 

3 

15 

0.20 

600 

2350 - 5000 

4 

20 

0.35 

600 

5000 - 10000 

5 

25 

0.55 

600 

10000 - 20000 

6 

30 

0.80 

600 

20000 - 42000 

7 

35 

1.10 

700 

> 42000 

7 

35 

1.10 

800 


unmitigated aircraft-pair encounters. This choice is partially 
motivated by the absence of a history of operational experience 
with UAS in civil airspace to substantiate the exact extent to 
which such mitigations may be relied upon [19]. 

This paper characterizes the effects of decoupling the ver- 
tical time threshold from the horizontal time threshold in 
terms of time to WCV and mathematical interoperability with 
TCAS II, both for unmitigated, constant-velocity, near-mid- 
air collision (NMAC) encounters. Because existing aircraft 
encounter models do not sufficiently model UAS flight profiles 
[21], such encounters were intended to represent a base case 
of particular interest. The main contribution of this paper is 
the provision of both analytical and Monte Carlo simulation 
results, which together give a closed-form representation and 
an intuitive visualization of the effects of selecting different 
values for TCOA for a particular WCB definition with respect 
to the time to WCV and the mathematical interoperability with 
TCAS II, for the given encounter model. 

The remainder of the paper is organized as follows. Sec- 
tion II gives a summary of the WCB models under considera- 
tion [18]. Section III derives a set of closed-form expressions 
and relationships for understanding the effects of a vertical 
time threshold on time to WCV. Section IV provides a set 
of closed-form expressions conjectured to define a worst case 
TCAS II RA interoperability metric for arbitrary values of a 
vertical time threshold. Section V discusses the design and 
results of the Monte Carlo simulation, which quantifies the 
analytical results presented in Sections III and IV. Finally, 
Section VI provides concluding remarks. 

II. A Class of Well-Clear Boundary Definitions 

In the subsequent mathematical development, letters in 
bold-face denote two-dimensional (2-D) vectors. Vector op- 
erations such as addition, subtraction, scalar multiplication, 
dot product, i.e., s • v = s x v x + s y v y , the square of a vector, 
i.e., s 2 = s • s, and the norm of a vector, i.e., ||s|| = x/s 2 , 
are defined in a 2-D Euclidean geometry. Furthermore, all 
development presented in this paper and marked as a Lemma , 
Corollary , or Theorem has been formally specified and verified 
in the Prototype Verification System (PVS) [27]. In particular, 
a formal proof in PVS provides a mathematical guarantee that 
a stated relationship, equation, algorithm, etc, holds exactly as 
specified. Such formal methods are routinely used in math- 
ematics, engineering, computer science, and particularly in 
areas demanding a high degree of certainty in the results, such 
as safety-critical systems. However, to make the following 
presentation accessible to non-PVS users, this paper uses 
mathematical notation instead of PVS concrete syntax. 

The class of WCB models considered in this paper are 
related by their dependence on time and distance thresholds in 
the horizontal and vertical dimensions. The models in this class 
differ only in the particular horizontal time variable, denoted 
£ var , used to check against a horizontal time threshold TTHR. 
Henceforth, WCB tvar denotes the particular WCB model for the 
time variable £ var . As in [18], this paper considers two aircraft, 
called ownship and intruder aircraft, whose states are given 



by position and velocity vectors in a Euclidean coordinate 
system. Thus, a pairwise WCB tvar violation is then completely 
characterized by the Boolean formula 

WCV tv>r (s ,s z ,v,v z ) & HWCVt var (s, v) and 

WlCV(s z ,v z ), ' ' 

where s, v e R 2 are the respective ownship-intruder relative 
horizontal position and velocity vectors, and s z ,v z E M are 
the respective ownship-intruder relative vertical position and 
velocities. The horizontal and vertical checks given in (1) are 
respectively defined as 

HWCV tvar (s, v) = ||s|| < DTHR or 

(d cpa (s, v) < DTHR and 0 < t var (s, v) < TTHR), 

VWC V(s z ,v z ) = |s*| < ZTHR or 

0 < t cm (s z ,v z ) < TCOA, 


particularly relevant to this paper, and in vector notation, is 
defined as 


Tnod(s, V) 


DTHR 2 — s 2 
s-v 

-1 


if s • v < 0, 
otherwise. 


(7) 


As is the case for the other time variables, r mod is defined as —1 
when the aircraft are not converging. For a given sensitivity 
level, the TCAS II RA logic corresponds to the Boolean 
formula WCV Tmod , as defined in (1), where t var is instantiated 
with r mod . Furthermore, the thresholds DTHR, TTHR, ZTHR, 
and TCOA appearing in (2) and (3) are respectively equal to 
the TCAS II RA threshold values DMOD, Tau, ZTHR, and 
Tau in Table I. 

The family of WCB models resulting from the time vari- 
ables listed above is formally studied in [18]. For example, 
it is proved that for the same choice of threshold values, the 
following containment relationships hold: 


where TTHR and DTHR are the respective time and distance 
thresholds in the horizontal dimension, and TCOA and ZTHR 
are the respective time and distance thresholds in the vertical 
dimension. The function d cpa in (2) computes the projected dis- 
tance between the ownship and intruder at their closest point 
of approach, assuming constant relative horizontal velocity, v, 
and is formally defined as 

d c P »(s,v) = ||s + f cpa (s,v)v||, (4) 


where £ cpa is the time at closest point of approach, which is 
defined as 


t c pa(s,v) 


if II v || N 0, 

0 otherwise. 


(5) 


Note that £ cpa ( s, v) > 0 when the aircraft are horizontally 
converging, £ cpa (s,v) < 0 when the aircraft are horizontally 
diverging, and £ cpa (s, v) = 0 when the aircraft are at the closest 
point of approach. The function £ coa in (3) computes the time 
to co-altitude assuming constant relative vertical speed v z and 
is defined as 


tco,(s z ,V z ) = 



if s z v z < 0, 

otherwise. 


( 6 ) 


Similar to the horizontal case, the product s z v z characterizes 
whether the aircraft are vertically diverging, i.e., s z v z > 0, or 
vertically converging, i.e., s z v z < 0. For completeness, this 
paper defines time to co-altitude as —1 when the aircraft are 
not vertically converging. 

The function £ var in (1) is a horizontal time variable de- 
termined by the particular WCB model being used. Possible 
choices for the time variable £ var are tau (r), defined as range 
over closure rate, modified tau [28] (r mod ), which is a variant 
of tau used in the TCAS II alerting logic, time to closest point 
of approach (£ cpa ), and time to violation of DTHR (£ ep ). The 
time variable £ cpa is as defined in (5), and formal definitions 
of r and £ ep are found in [18]. Modified tau is a time variable 


WCB t C WCB tppa C WCB TmoJ C WCB* ep . (8) 

These relationships guarantee that for the models WCB Tmod 
and WCB tep , there exists a choice of parameters that makes 
the boundaries larger than the TCAS II RA boundary. 

Another property studied in [18] is local convexity. A 
boundary model is locally convex if for nonmaneuvering, i.e., 
constant-velocity, encounters there exists at most one time 
interval of well-clear violation. It is formally proved in [18] 
that, with the notable exception of WCB r , all the other models 
in (8) are locally convex. The lack of the local-convexity 
property in WCB r is related to well-known problems with the 
definition of tau [28], which makes it impractical to use this 
particular model as a basis for a SAA concept. Henceforth, 
this paper only considers the WCB models that are locally 
convex. 

For locally convex models, it is possible to define a detec- 
tion algorithm which computes a time interval of well-clear 
violation for nonmaneuvering pairwise encounters; the generic 
algorithm WCD tvar in (9) has as inputs a relative state and a 
lookahead time interval [B,T\. This algorithm returns a time 
interval when a violation of WCB tvar will occur and is defined 
as 

WCD tvar (s ,s z ,v,v z ,B,T) = 

let [ti,t 2 \ m VWCD(s z ,v z ,B,T) in 
if fi > f 2 then 0 

elsif t\ = t 2 and HWCV tvar (s + fiv, v) 

then 

(9) 

elsif t\ = £2 then 0 
else 

let [t m , f out ] = HWCD tvar (s + f i v, v, t 2 - fi) in 

[f in + / 1. 5 ^OUt + tl\ 

endif, 

where HWCD tvar and VWCD are functions that compute time in- 
tervals of violation for the horizontal and vertical dimensions, 
respectively. Precise definitions of VWCD and HWCDt var , for 



£ var £ {r m0 d, £ cpa , £ ep }, are provided in [18], and these definitions 
are assumed in this paper. Furthermore, 0 denotes that no well- 
clear violation is predicted to occur. 

Since the vertical check VWCV is independent of £ var , the 
function VWCD that computes the time interval for a vertical 
well-clear violation is the same for any WCB tvar model. On 
the other hand, the horizontal check HWCV tvar depends on 
the definition of the time variable £ var . Hence, a horizontal 
detection function HWCD tvar for each particular definition of £ var 
is necessary. The following theorem, which has been formally 
proved in [18], states that WCD tvar completely characterizes the 
time interval of WCB tvar violation within the lookahead time 
interval [B,T], for nonmaneuvering pairwise encounters. 

Theorem 1. Let £ var be one of r mod , £ cpa , or £ ep . For all relative 
states denoted by s ,s z ,v,v z , time interval [B,T\, with 0 < 
B < T, and £ e [B,T], WCV tvar (s + £v, s z +tv z , v,v z ) is equal 
to true if and only if £ £ [£ in ,£ out ], where 

[iin,iou.] = WCD tvai (s ,s z ,v,v z ,B,T). (10) 

If £ in < £ out in (10), £ in and £ out denote the first and last 
times within [ B , T] when a violation of WCB tvar occurs in a 
nonmaneuvering encounter. Henceforth, these times to WCV 
will be denoted £ A 1 and £^, where A"! is a particular locally 
convex, well-clear boundary model. 

III. Effects of TCOA on Time to Well-Clear 
Violation 

Consider a model WCB tvar as defined in Section II, and let 
this model have two instantiations that coincide in their thresh- 
old values DTHR, TTHR, and ZTHR but differ in the partic- 
ular choice of the vertical time threshold, TCOA. Let these 
instantiations be denoted by Mo and Mi, having TCOAo 
and TCOAi, respectively, such that TCOA 0 < TCOAi. The 
metric A £ in = £j^° — t^ 1 then characterizes the difference in 
time to well-clear violation between two models, based ex- 
clusively on the particular choices of TCOA. In the following 
development, a closed-form expression for an upper bound on 
A £ in is derived for the case of unmitigated, nonmaneuvering 
encounters resulting in a near mid-air collision. 

As discussed in Section II, a well-clear violation results 
from simultaneous violations in the vertical and horizontal 
dimensions. In particular, if a violation is predicted to occur 
in the vertical dimension within the given lookahead time, 
the horizontal dimension is checked. If a violation is also 
predicted to occur within the given lookahead in the horizontal 
dimension, a time interval for the well-clear violation is 
computed by the function WCDt var . The following lemma gives 
a closed-form expression for the difference in time to a vertical 
well-clear violation between Mo and Mi, denoted A£ ia . 

Lemma 1. For any relative vertical state denoted by s z and 
v z such that the vertical time interval of violations for Mo 
and Adi in the lookahead time interval [B,T] are nonempty, 


the vertical metric AB satisfies the following equalities. 


At* = 


<0o-0i 

t©o-£ 


if v z = 0 or 0 O < B , 
if 0i > B , 
otherwise, 


where, for i = 0, 1, 


q _ -sign (vQHj - 
" ' ~ Vz 

Hi = max(ZTHR, TCOAi \v z \). 


(ID 


( 12 ) 

(13) 


The proof of Lemma 1 proceeds by case analysis according 
to the definition of VWCD provided in [18]. The following 
lemma, which is a consequence of Lemma 1, states that the 
initial time to well-clear violation for the vertical dimension 
computed for M\ is less than or equal to that computed for 
Mo, i*e., At* > 0. It also gives the maximum value that A t* n 
can take, given two arbitrary values of TCOA. 

Lemma 2. For any relative vertical state denoted by s z and 
v z such that the vertical time interval of violations for Mo 
and Ali in the lookahead time interval [B,T] are nonempty, 
the vertical metric At* satisfies the following relations: 


0 < A t z < 


0 if v z = 0, 

otherwise, 

\Vz I 


(14) 


where Hi, for i = 0, 1, is defined as in (13). 


The specification of WCD tvar in Section II uses the ver- 
tical time interval of violation in the computation of the 
horizontal time interval of violation. In particular, the time 
interval [£i , £ 2 ] in (9), which denotes the time interval of 
violation in the vertical dimension, appears in the expression 
HWCD tvar (s+£iv, v, £2 — £1), which computes a time interval of 
violation in the horizontal dimension. In that expression, the 
first and second parameters represent relative 2-dimensional 
position and velocity vectors, respectively. The last param- 
eter represents a horizontal lookahead time. The following 
lemma gives a relationship between HWCD tvar (s, v, T) and 
HWCD tvar (s + £iv, v,£2 — £1) for an arbitrary definition of a 
locally convex WCB tvar . 

Lemma 3. Consider the definition of WCD tvar in Section II 
for a locally convex WCB tvar . For any relative horizontal state 
denoted by s, v, lookahead time T, and times 0 < t\ < £2 < 

T, let [a 0 , /?o] = HWCD( vjr (s, v, T) and [on, ft] = HWCD tvar (s+ 
£iv, v,£2 — £1) be such that do < /?o, ol\ < Pi, and £1 < ao. 

Then, the following equation holds: 


cio — £1 + di. 


(15) 


The proof of Lemma 3 uses the fact that the function WCD tvar 
in (9) completely characterizes the time interval of violation 
for any locally convex WCBt var . This lemma provides sufficient 
conditions under which the time to horizontal well-clear 
violation linearly shifts at the same rate as time progresses 
in a nonmaneuvering pairwise encounter. 



Now, the following theorem combines the results of 
Lemma 2 and Lemma 3 to give an overall upper bound for 
A t m for the three-dimensional case. 


the maximum value for A t in is 

lim At in = TCOAi . (19) 


Theorem 2. Consider the definition of WCD tvar in Section II 
for a WCB tvar , where t„ e (f cpi , r mod , f ep }, i.e., locally convex. 
For any relative state denoted by s, v, s z , and v z such that 
B < t^° < t^ t ° < T, the metric A t m satisfies the following 
relations. 


0 < A t m < 


0 

Hi -Ho 


if v z = 0, 

otherwise, 


where Hi, for i = 0, 1, is defined as in (13). 


(16) 


The proof of Theorem 2 proceeds by case analysis on 
the definition of WCD tvar in (9). In each case, Lemma 2 and 
Lemma 3 are used as appropriate. 

The following corollary addresses the special case when 
TCOA 0 = 0. 


Corollary 1. Let Mo, Mi be such that TCOA 0 = 0 and 
TCOAi > 0. In this case, the upper bound in (16) reduces to 


A t iQ < 


' TCOAi | v z | — ZTHR 

\Vz\ 

0, 


if TCOAi | v z | > ZTHR, 
otherwise. 


(17) 


A consequence of Corollary 1 is that the smallest vertical 
closure rate, /i, such that a particular choice of TCOAi for 
Mi is able to provide any earlier time to well-clear violation 
over Ado is 


ZTHR 

M > TCOAi ' 


(18) 


Fig. 1 illustrates the theoretical upper bound on A t in given 
by Corollary 1 for WCB Tmod when B — 0 and T = 1201 s. The 
particular threshold values for TTHR, DTHR, and ZTHR are 
35 s, 1.5 nmi, and 450 ft, respectively. Furthermore, TCOAo = 
0, and TCOAi is allowed to vary as indicated by the legend. 
By inspection of (17), for given values TCOAi and ZTHR, 



• • • 

TCOA = 0 s 


TCOA =5 s 

• • • 

TCOA= 10 s 

• • • 

TCOA= 15 s 


TCOA = 20 s 

• • • 

TCOA = 25 s 

• • • 

TCOA = 30 s 

• • • 

TCOA =35 s 
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Although values beyond \v z \ = 10,000 ft/min are not pre- 
sented in Fig. 1, this limiting behavior can still be seen in 
the figure. Furthermore, Fig. 1 can be used to compare Mo 
and M\ when both models use nonzero TCOA. In particular, 
when \v z \ > , it can be verified that 

A t m = TCOAi - TCOA 0 . (20) 

For \v z \ satisfying < \v z \ < , it can be shown 

that 

. TCOAi \v z \ —ZTHR 
At m = ^ , (21) 

\Vz\ 

and for \v z \ < ^)a , A t in is identically zero. 

IV. Interoperability with TCAS II 


The subsequent development presents the mathematical in- 
teroperability of a WCB model with the TCAS II RA logic. In 
particular, interoperability in the context of this paper implies 
that if a well-clear violation is predicted to occur within a 
given lookahead interval then the resulting time to WCV will 
precede the time to TCAS II RA, regardless of whether the 
RA is preventive or corrective. 

As discussed in Section II, the high-level TCAS II RA 
logic for a given sensitivity level can be represented by a 
model 1Z = WCB Tmod , where the threshold values of 1Z, 
denoted DTHR 7 *, TTHR 7 *, ZTHR 7 *, and TCOA 7 *, are set to 
the TCAS II threshold values from Table I, i.e., DTHR 7 * = 
DMOD, ZTHR 7 * = ZTHR, and TTHR 7 * = TCOA 7 * = Tau. 
Now, for any model M = WCB tvar , where t var G {r mod ,t ep }, 
there exists a choice of threshold values of M, denoted 
DTHR^, TTHR^, ZTHR^, and TCOA^, that makes M 
compatible with 7 Z. To provide a measure of interoperability 
of M with the TCAS II RA logic, the time to WCV in 
the model M, i.e., t^ 1 , is computed and subtracted from 
the time to TCAS II RA, i.e., tj, for a given encounter 
geometry. The resulting metric of interoperability is given as 
AtJ = tjf — t^ 1 . Interoperability requires that AtJ > 0. This 
definition motivates investigation of interoperability in terms 
of worst-case, i.e., minimum, bounds on Atf . 

Because TCAS II uses aircraft altitude to determine the 
sensitivity level, which in turn specifies the thresholds used 
to trigger an RA, there are a large number of interoperability 
cases to consider. However, the following conjecture is a 
preliminary result, which gives a general minimum bound on 
A t™ for any sensitivity level, assuming unmitigated, constant- 


velocity NMAC trajectories, absent any TCAS II RA suppres- 
sion logic. In particular, it is conjectured that the following 
four inequalities govern the minimum value A t 7 ^: 


• If \v z \ < min( 


ZTHR^ 4 

tcoa^ 5 


ZTHR 

Tau 


a e> 


ZTHR M - ZTHR 


( 22 ) 


Fig. 1. Theoretical upper bound on At in for WCB Tmod 
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At* > TCOA^ 1 - Tau. 


(23) 


(24) 


(25) 


A key assumption in this conjecture is that the horizontal 
thresholds for M are larger than those for 7 Z, and thus, lack 
of interoperability is due to artifacts in the vertical dimension, 
i.e., DTHR^ 4 > DMOD and TTHR^ 4 > Tau. 

Fig. 2 shows the theoretical minimum values for AtJ and 
WCB Tmod as a function of \v z \ for the particular case of TCAS 
II sensitivity level 4 and threshold values for M as indicated 
in the legend. Note that the plots for TCOA = 0 s and 
TCOA = 5 s coincide for the displayed range. Inspection 
of Fig. 2 illustrates that there are vertical closure rates where 
interoperability is not mathematically guaranteed for certain 
choices of TCOA. In particular, choosing TCOA^ < Tau = 
20 s results in the situation that mathematical interoperability 
is never guaranteed. Conversely, for TCOA^ 4 > Tau, mathe- 
matical interoperability is guaranteed beyond certain vertical 
closure rates. Furthermore, inspection of (22)-(25) shows that 
there are threshold values for M such that mathematical 
interoperability is always guaranteed. However, the fact that a 
choice of thresholds guarantees mathematical interoperability 
with the TCAS II RA logic does not necessarily lead to an 
operationally desirable definition for well clear. 


V. Simulation 

A. Design Approach 

The Monte Carlo simulation design approach was primarily 
motivated by the lack of aircraft encounter models in civil 
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Fig. 2. Minimal vertical TCAS II RA interoperability. 


airspace that sufficiently incorporate UAS flight characteristics 
[21] and the lack of broad operational experience with UAS 
in an integrated civil airspace [19]. While the encounter 
space was limited to unmitigated, constant-velocity NMAC 
trajectories as the base case of interest, the overall goal was to 
otherwise not overly constrain the simulation with assumptions 
beyond maintaining feasibility in the encounters. In particular, 
parameters were chosen from uniform distributions, where 
the upper and lower bounds were selected such that the 
full trade space of possible encounters could be explored. 
Furthermore, the simulation results afford a means to visually 
convey the formally verified effects of TCOA on A given 
in Section III and the conjectured effects of TCOA on A t* 
given in Section IV. In the absence of established operational 
experience with such encounters in the context of UAS in 
the civil airspace, these results may provide some basis for 
selecting a particular value for TCOA in a formal definition of 
well clear, or perhaps for omitting the vertical time threshold, 
entirely. 

The simulation was composed of eight independent Monte 
Carlo runs, where each of the eight runs considered a different 
value for TCOA. The first run set TCOA to zero, subsequent 
runs incremented TCOA by 5 seconds, and the final run set 
TCOA = 35 s. Each of the eight runs consisted of 5000 
randomly generated aircraft-pair encounters determined by 
sampling from several characterizing uniform random vari- 
ables as follows: 

1) encounter duration, £ e G (0, 1200] s, 

2) the two-dimensional relative horizontal speed, v G 
(0, 1185] kn, 

3) a point inside a collision volume, centered on the origin, 
and having parameters (r, </>, z), where r G [0,500] ft, 
0 G [0,360]°, z G [-100,100] ft, 

4) an angle, 6 , with respect to the horizontal plane such 
that 0 G [-90,90]°, 

5) the relative vertical speed, v z G (0, 10000] ft/min, 
where the choice to limit \v z \ to 10,000 ft/min was based on 
the design of TCAS II, which is capable of detecting vertical 
closure rates up to 10,000 ft/min [23]. 

The parameters r,(f),z and 0 were together used to determine 
the relative velocity vector and terminating point inside the 
collision volume, and the parameter t e was used to set the 
initial relative position such that at time t e , the final relative 
position was — (r, 0, z), i.e., the intruder position was the 
terminating point inside the collision volume. The lookahead 
interval for WCB Tmod was set to [0,t e + 1]. Furthermore, only 
cases of future WCVs were considered, so that if the randomly 
generated scenario placed the aircraft into an immediate WCV, 
the scenario was discarded. The process was repeated until a 
given trial accumulated 5000 WCVs. 

For each randomly generated encounter scenario, three mod- 
els were considered: (1) the WCB Tmod model having TCOA > 
0, i.e., Mi, (2) the WCB Tmod model having TCOA = 0, i.e., 
Mo, and (3) the WCB Tmod model having the TCAS II RA 
threshold values, i.e., 7Z. The metric A t in was determined by 
subtracting t^ 1 from , and metric AtJ was determined 


by subtracting t^ 1 from t™. The parameters for WCB Tmod 
were set as: DTHR^ 4 = L5 nmi; ZTHR^ 4 = 450 ft; and 
TTHR^ 4 = 35 s. The TCAS II parameters used in the simu- 
lation corresponded to sensitivity level 4, i.e., DMOD = 0.35 
nmi; ZTHR = 600 ft; and Tau = 20 s. The greater TCAS II 
ZTHR value allows for TCAS II RAs to be issued prior to 
a WCV for certain vertical closure rates, however, a 500 ft 
vertical miss distance is generally acceptable for safe air traffic 
procedures flying under VFR [29]. This tradeoff in selecting 
ZTHR was made in order to provide a practical visualization 
of the implications associated with selecting particular values 
forTCOA. 

B. Simulation Results and Discussion 

Fig. 3 illustrates the simulation results for A t in , as derived 
in Section V-A, for several values of TCOA. In particular, Mo 
has TCOA = 0 and M i has TCOA as indicated in the legend. 
The results provide a means to compare how different models 
M\ compare to a nominal model, Mo , which does not use 
a vertical time threshold. The simulated encounters obey the 
theoretical upper bounds illustrated in Fig. 1. 

It can be verified that for any TCOAi satisfying 0 < 
TCOAi < TTHR^ 4 there is some vertical closure rate, /i, 
such that an earlier time to WCV is possible. In Section III, 
it was shown that for any TCOA, it is the case that /i > 
ZTHR^ /TCOAi. When TCOAi = 0, A t in is identically zero, 
and no earlier time to WCV is possible. For the case when 
TCOAi = TTHR^ 4 , the simulation results in occasions when 
the upper bound earlier time to WCV is not achieved. This case 
illustrates the subtractive effect of the horizontal component 
on A £ in , a consequence of Lemma 3. However, Fig. 3 also 
shows that A £ in closely follows the theoretical upper bound. 
Some key results illustrated in Fig. 3 follow. 

For the case when TCOAi = 25 s, the smallest vertical 
closure rate such that M\ can provide an earlier time to 
WCV is greater than 1080 ft/min. Furthermore, for Mi a 16 s 
earlier time to WCV over Mo is not only possible, but is the 


case for vertical closure rates of 3000 ft/min. Moreover, for a 
3000 ft/min vertical closure rate, Mo gives a time to WCV 
7 s prior to NMAC, while Mi gives a time to WCV 23 s 
prior to NMAC. 

Now, for the same threshold values, if the vertical closure 
rate increases to 6000 ft/min then Mo gives a time to WCV 
3.5 s before NMAC, and Mi gives a time to WCV 24 s 
before NMAC. Although pilot or automation reaction time 
is beyond the scope of this paper, it is assumed that there is 
some need to account for such latencies in threshold selection, 
and that an earlier time to WCV can provide some means of 
mitigation. Conversely, too large a vertical time threshold may 
have undesirable operational implications. 

Next, Fig. 4 shows the results of the Monte Carlo simulation 
with respect to A t™. In particular, the results depicted in 
Fig. 4 correspond to the same encouter set used to gener- 
ate Fig. 3. At higher vertical closure rates, the value At™ 
is dominated by TCOA — Tau and thus exhibits somewhat 
constant behavior. This limiting behavior first occurs when 
\v z \ > max(ZTHR/Tau, ZTHR^/TCOA), or 1800 ft/min. 

To better illustrate the critical points determined by TCOA, 
a restricted set of data is presented in Fig. 5. Now, comparing 
Fig. 5 with the conjectured theoretical minima shown in Fig. 2, 
it can be verified that the conjectured minima are satisfied. 
Furthermore, at lower vertical closure rates the overall inter- 
operability picture is similar for all values of TCOA. Further 
note that for \v z \ > 1800 ft/min, the conjectured minima in 
the limit not only hold but are also useful approximations of 
the simulation results for At™. Finally, the particular threshold 
values used for TCAS II also illustrate that there exist some 
mathematical interoperability implications for any choice of 
TCOA. 

Fig. 6 further restricts the plotted data set from the same 
Monte Carlo simulation to two particular TCOA values of 
interest, i.e., TCOA 0 = 0 s and TCOAi = 25 s. Fig. 6 also 
reinforces the general picture of similar TCAS II interoperabil- 
ity for both models at lower vertical closure rates. However, as 
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the vertical closure rate increases, the dissimilarity of the two 
models becomes pronounced. For TCOAi = 25 s, guaranteed 
TCAS II interoperability first occurs at \v z \ > 1440 ft/min and 
is maintained for all higher vertical closure rates, while for 
TCOAo = 0 s, TCAS II interoperability is never guaranteed. 
Indeed, the simulation results illustrate that TCOA 0 = 0 s 
is closely approximated by the theoretical minimum where 
TCAS II RAs will be issued prior to a WCV. 

At higher vertical closure rates, the interoperability differ- 
ences associated with TCOAo and TCOAi become clear. For 
example, at 3000 ft/min vertical closure rate, TCOAi provides, 
at a minimum, a time to WCV 5 s prior to TCAS II RA, 
whereas TCOAo provides, at a minimum, a time to WCV 11s 
after a TCAS II RA has been issued. Furthermore, consider 
the case of a 6000 ft/min vertical closure rate. In this case, 
TCOAi still generally provides a 5 s earlier time to WCV than 


TCAS II RA, however, the situation for TCOA 0 worsens to 
A = -17.75 s. 

Attempting to alleviate such interoperability concerns for 
Mo by adjusting other threshold parameters, e.g., ZTHR^ 4 , 
is problematic. For example, consider the case of raising 
ZTHR'^ for Mo and Mi to 700 ft. to be above the TCAS II 
ZTHR at sensitivity level 4. Fig. 7 illustrates the results. These 
results indicate that while positive interoperability is offered 
for both models at modest vertical closure rates, Mo again 
faces interoperability problems at vertical closure rates of 
approximately 2000 ft/min. Mitigating feasible vertical closure 
rate encounters in such a way may also be operationally 
prohibitive. The picture for M\ improves to guaranteeing 
interoperability over all vertical closure rates. 

The simulation results demonstrate that for unmitigated, 
constant- velocity NMAC trajectories, a well-clear definition 
using horizontal and vertical time and distance thresholds, 
such that TCOA < Tau, generally does not offer a protective 
barrier outside of the TCAS II collsion avoidance logic. That 
is, in such encounter geometries, the well-clear boundary 
collapses to the TCAS II RA threshold. Thus, under these 
circumstances, the formal definition of well clear does not 
serve as a mitigation to the collision avoidance function. 
These results may provide some basis in exploring tradeoffs 
between desireable, verifiable safety properties and practical 
operational considerations in the selection of an appropriate 
vertical time threshold in a formal definition of well clear. 

VI. Conclusion 

The safe integration of UAS into civil airspace will require 
that unmanned aircraft be capable of detecting and avoiding 
other aircraft in a way that is compatible with existing manned 
aircraft operations. That is, unmanned aircraft should behave 
in a way that is relatively predictable to other aircraft, par- 
ticularly manned aircraft, in terms of well clear and collision 
avoidance functionality. The class of WCB models considered 
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in this paper were investigated for their suitability for meeting 
such interoperability requirements with respect to a vertical 
time threshold. The primary motivation for the investigation 
resulted from the observation that the well-clear definitions 
explicitly allowed for decoupling of the horizontal and vertical 
time thresholds. This decoupling makes it possible to eliminate 
either or both of the time thresholds. Since elimination of a 
horizontal time threshold was not considered to be a likely 
characteristic in any practical definition of well clear, the 
investigation took the approach of directly analyzing the role 
of the vertical time threshold in the formal definition. A 
primary goal of the paper was to provide suitable intuition to 
the separation community and designers of detect and avoid 
systems on the interoperability consequences associated with 
particular choices of vertical time thresholds. 

A closed-form, upper-bound relationship for earlier time to 
WCV was given as a function of vertical-closure rate for dif- 
ferent choices of vertical time thresholds. This relationship was 
formally verified to hold for unmitigated, constant-velocity 
NMAC trajectories, and simulation results were shown to 
illustrate the consistency of the theory with the randomly 
generated encounters. The simulation reveals some important 
operational tradeoff considerations in terms of interoperability 
with manned aircraft expectations of what is well clear, 
particularly for higher vertical time thresholds. For example, 
at a vertical closure rate of 3000 ft/min, a UAS relying on 
the formal definition can still be well clear 7 s before NMAC, 
well after a human pilot has likely initiated collision avoidance 
maneuvers, absent intent information, i.e., unmitigated. The 
closed-form expressions provided in this paper may serve as 
tools for further assessment of the implications of particular 
choices of vertical time thresholds on a formal well-clear 
definition. 

Furthermore, a preliminary result was given, in which a set 
of closed-form relationships was conjectured to govern the 
mathematical interoperability with existing TCAS II issuance 
of RAs for unmitigated, constant- velocity NMAC trajectories. 
While corrective RAs are of particular concern, this paper 
investigated interoperability for both cases of corrective and 
preventative RAs at TCAS II sensitivity level 4. However, 
further analysis is possible at sensitivity levels of interest 
through the conjectured theoretical minima for the TCAS II 
interoperability metric. It was demonstrated that these minima 
are satisfied by all of the simulated encounters and that 
they were reasonably approximated by At™ at higher vertical 
closure rates. At TCAS II sensitivity level 4, all choices of 
TCOA result in roughly the same mathematical interoperabil- 
ity characteristics at lower vertical closure rates. For these 
higher vertical closure rates, mathematical interoperability 
for the particular thresholds considered is guaranteed when 
TCOA > Tau. It was also shown that increasing ZTHR may 
offer some improvement for interoperability, however these 
gains are lost at higher vertical closure rates. 

The mathematical development presented in this paper, 
including definitions and theorems, has been specified and 
verified in the interactive theorem prover, PVS. A theorem 


prover is a computer program that provides a specification 
language and a logic engine that checks every deduction 
step of a mathematical proof. This verification process is 
particularly time consuming, but justified by the safety-critical 
nature of sense and avoid in the future integration of UAS into 
civil airspace. 
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